Cloudanix VulnDB

CVE-2026-116695

None

CVSS

—

EPSS

0.4%

Published

Oct 27, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A CSS parsing library used by sanitizers can let certain malicious style instructions slip through instead of being removed, which may allow attackers to alter page appearance or load outside resources.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The parser fails to terminate a bad URL token when encountering a closing parenthesis after an escaped backslash, preserving subsequent declarations, style rules, and at-rules inside the token that browsers will interpret as active CSS.

Why it matters to the business

Organizations relying on CSS sanitization to process untrusted stylesheets face increased risk of UI manipulation, external resource fetches, and data exfiltration through CSS channels without any code execution occurring.

How an attack unfolds

An attacker supplies crafted CSS containing a malformed URL token that embeds live style rules; the vulnerable parser keeps the inner rules intact during reserialization, allowing a browser to apply the attacker-controlled CSS for attacks such as clickjacking or resource loading.

How to fix it

Upgrade Crass to version 1.0.8 or later; reject or strip any input that produces bad URL tokens during sanitization.

How to confirm the fix worked

Confirm the installed Crass version is at least 1.0.8; test the parser with known bad-URL test cases to verify that inner rules are no longer preserved after reserialization.

Typical attack path

  1. Construct CSS payload with escaped backslash followed by closing parenthesis and embedded active rules
  2. Submit payload to a sanitizer that uses the vulnerable parser
  3. Obtain reserialized stylesheet that retains the inner rules
  4. Deliver the stylesheet to a victim application or user
  5. Browser interprets the preserved rules to perform UI redress or external loads

How to detect it

Inspect application or proxy logs for CSS content containing escaped backslashes immediately followed by closing parentheses and subsequent rule blocks; correlate with sanitizer output that retains such constructs.

What your security team should do

  • Immediately upgrade all instances of Crass to 1.0.8
  • Review CSS sanitization pipelines for reliance on version 1.0.7 or earlier
  • Add runtime checks that drop any stylesheet containing unresolved bad URL tokens
  • Monitor for new disclosures related to this parser within the next 30 days

The record

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities